CVE-2026-99113

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99113", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.392Z", "datePublished": "2026-10-28T10:34:30.767Z", "dateUpdated": "2026-10-30T12:41:51.384Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:51.384Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n\nsmb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,\nthat is the whole of struct object_id_info, but writes only 46 of them:\n\n - objid[] is 16 bytes, and when the volume UUID is not available only\n sizeof(stfs.f_fsid) (8) bytes are copied into it;\n - extended_info.version_string[] is STRING_LENGTH (28) bytes, and only\n strlen(\"1.1.0\") (5) bytes are copied into it.\n\nThe response buffer is zeroed on allocation (kvzalloc() in\nsmb2_allocate_rsp_buf()), so for a standalone request the remaining 31\nbytes are zero. In a compound request they need not be. The offset of\nthe next response is advanced by the length pinned for the previous one,\nso if a preceding command wrote its reply into the buffer and then\nfailed, smb2_set_err_rsp() pins only the short error response and the\nnext reply lands inside the area that has already been written. Only\nthe header is cleared there:\n\n\tmemset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);\n\nThe client then receives up to 31 bytes of a response it was not meant\nto see, including one that failed with an access denied error.\n\nClear the structure before filling it in. As a side effect\nversion_string is now NUL terminated."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c"], "versions": [{"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "dbd0f13de153d7094b85034daffa7533d7c2b17a", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "90898571fb2c6813c007a62833dd65c00481d44e", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "1a35a81c302b36fe4acd35b47b51d5d73e89ba0a", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "3fc33ac2125b60f103592b83821f69f3f9aa23ba", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "898cb4f2e12a5ddea1b2d821cc642c3100f46da7", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "015fffa48e96ca8d73a627445341ccff86b02251", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "399aa12450a61a5c73dc77e73f069ece9687c95d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dbd0f13de153d7094b85034daffa7533d7c2b17a"}, {"url": "https://git.kernel.org/stable/c/90898571fb2c6813c007a62833dd65c00481d44e"}, {"url": "https://git.kernel.org/stable/c/1a35a81c302b36fe4acd35b47b51d5d73e89ba0a"}, {"url": "https://git.kernel.org/stable/c/3fc33ac2125b60f103592b83821f69f3f9aa23ba"}, {"url": "https://git.kernel.org/stable/c/898cb4f2e12a5ddea1b2d821cc642c3100f46da7"}, {"url": "https://git.kernel.org/stable/c/015fffa48e96ca8d73a627445341ccff86b02251"}, {"url": "https://git.kernel.org/stable/c/399aa12450a61a5c73dc77e73f069ece9687c95d"}], "title": "ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dbd0f13de153d7094b85034daffa7533d7c2b17a", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "90898571fb2c6813c007a62833dd65c00481d44e", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "1a35a81c302b36fe4acd35b47b51d5d73e89ba0a", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "3fc33ac2125b60f103592b83821f69f3f9aa23ba", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "898cb4f2e12a5ddea1b2d821cc642c3100f46da7", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "015fffa48e96ca8d73a627445341ccff86b02251", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "399aa12450a61a5c73dc77e73f069ece9687c95d", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n\nsmb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,\nthat is the whole of struct object_id_info, but writes only 46 of them:\n\n - objid[] is 16 bytes, and when the volume UUID is not available only\n sizeof(stfs.f_fsid) (8) bytes are copied into it;\n - extended_info.version_string[] is STRING_LENGTH (28) bytes, and only\n strlen(\"1.1.0\") (5) bytes are copied into it.\n\nThe response buffer is zeroed on allocation (kvzalloc() in\nsmb2_allocate_rsp_buf()), so for a standalone request the remaining 31\nbytes are zero. In a compound request they need not be. The offset of\nthe next response is advanced by the length pinned for the previous one,\nso if a preceding command wrote its reply into the buffer and then\nfailed, smb2_set_err_rsp() pins only the short error response and the\nnext reply lands inside the area that has already been written. Only\nthe header is cleared there:\n\n\tmemset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);\n\nThe client then receives up to 31 bytes of a response it was not meant\nto see, including one that failed with an access denied error.\n\nClear the structure before filling it in. As a side effect\nversion_string is now NUL terminated."}], "id": "CVE-2026-99113", "lastModified": "2026-10-30T13:21:45.783", "metrics": {}, "published": "2026-10-28T11:17:30.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/015fffa48e96ca8d73a627445341ccff86b02251"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a35a81c302b36fe4acd35b47b51d5d73e89ba0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/399aa12450a61a5c73dc77e73f069ece9687c95d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fc33ac2125b60f103592b83821f69f3f9aa23ba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/898cb4f2e12a5ddea1b2d821cc642c3100f46da7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90898571fb2c6813c007a62833dd65c00481d44e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbd0f13de153d7094b85034daffa7533d7c2b17a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in", "id": "2562760", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562760"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\nsmb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,\nthat is the whole of struct object_id_info, but writes only 46 of them:\n- objid[] is 16 bytes, and when the volume UUID is not available only\nsizeof(stfs.f_fsid) (8) bytes are copied into it;\n- extended_info.version_string[] is STRING_LENGTH (28) bytes, and only\nstrlen(\"1.1.0\") (5) bytes are copied into it.\nThe response buffer is zeroed on allocation (kvzalloc() in\nsmb2_allocate_rsp_buf()), so for a standalone request the remaining 31\nbytes are zero. In a compound request they need not be. The offset of\nthe next response is advanced by the length pinned for the previous one,\nso if a preceding command wrote its reply into the buffer and then\nfailed, smb2_set_err_rsp() pins only the short error response and the\nnext reply lands inside the area that has already been written. Only\nthe header is cleared there:\nmemset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);\nThe client then receives up to 31 bytes of a response it was not meant\nto see, including one that failed with an access denied error.\nClear the structure before filling it in. As a side effect\nversion_string is now NUL terminated.", "A flaw was found in the Linux kernel's ksmbd Server Message Block (SMB) file server. When handling compound file system query requests, the server fails to clear the response buffer before populating it. A remote client can exploit this vulnerability by sending specially crafted compound requests to trigger an information disclosure, exposing residual memory contents that may include data from prior restricted operations."], "name": "CVE-2026-99113", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99113\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99113\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99113.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,898cb4f2e12a5ddea1b2d821cc642c3100f46da7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,015fffa48e96ca8d73a627445341ccff86b02251)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,399aa12450a61a5c73dc77e73f069ece9687c95d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,898cb4f2e12a5ddea1b2d821cc642c3100f46da7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,015fffa48e96ca8d73a627445341ccff86b02251)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9,399aa12450a61a5c73dc77e73f069ece9687c95d)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:00:22.515264+00:00", "updated": "2026-10-29T15:15:15.420383+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-200", "CWE-908"]}